Patching Basics

In this exercise, you will practice installing patches on a Windows system, Linux system, and a Docker container.

We will begin with Windows. While there are many methods for managing security patches on Windows, in this exercise we will demonstrate how to install and apply security patches using PowerShell. First, you will need to install the Windows Update PowerShell module.

1. On the taskbar, right-click the Windows Start icon, and select Windows PowerShell (Admin) to open a new PowerShell window.
   
   When prompted, click Yes to continue.
   
2. At the PowerShell prompt, type Install-Module -Name PSWindowsUpdate -Force and press Enter to install the Windows Update PowerShell module.
   
   When prompted to install the NuGet provider, type Y and press Enter to continue.
   
   Installing PSWindowsUpdate will enable the set of PowerShell cmdlets used to manage Windows Update. The module may take 30-90 seconds to install.
   

   

3. At the PowerShell prompt, type Get-WindowsUpdate -IsInstalled and press Enter to display all the currently installed updates.
   

   

   Take note of the currently installed updates. A Status of DI means the update is downloaded and installed. A Status of U means the update can be removed if desired.
   
4. At the PowerShell prompt, type Get-WindowsUpdate and press Enter to see a list of available updates.
   

   

   Review the available updates. Each update will be designated by a KB number. KB stands for Knowledge Base - a reference to the corresponding Microsoft Knowledge Base article on that issue.
   
   Note: The screenshot above was taken in August 2023. Because Microsoft continues to release new updates, the list that you see will be much longer than what is shown in the screenshot.
   
   Next, we will outline the PowerShell commands used to install Windows updates. For the purposes of this exercise, we will not actually install any updates at this time.
   
   To install a specific update, you can the command the following command, where KBArticleID is the KB number of the update you wish to install (e.g., KB890830). You will be prompted to confirm the installation.
   Get-WindowsUpdate -Install -KBArticleID
   To install all available updates and skip the prompt, you can use the following command. This command will install all updates without prompting ( -AcceptAll) and reboot as needed ( -AutoReboot).
   Get-WindowsUpdate -AcceptAll -Install -AutoReboot
   What if you want to install everything except one or two updates known to cause issues? To do this, you can create a Hide List.
   
5. At the PowerShell prompt, type $HideList = "KB890830" and press Enter to set the $HideList variable to KB890830.
   
6. At the PowerShell prompt, type the following command and press Enter to create a new Hide List using the $HideList variable.
   Get-WindowsUpdate -KBArticleID $HideList -Hide
   When prompted, type Y and press Enter to continue.
   
   Notice the status is H for Hidden.
   

   

   Next, we will remove KB890830 from the Hide List.
7. At the PowerShell prompt, type $HideList = "" and press Enter to set the $HideList variable to an empty value.
   
8. At the PowerShell prompt, type Get-WindowsUpdate -KBArticleID $HideList -Hide and press Enter to update from the Hide List with the empty variable.
   
   You can confirm with Show-WindowsUpdate -KBArticleID $HideList.
   
   Next, let's look at patching a Linux system.
   
9. From the Machines tab, connect to the Ubuntu server.
   
10. On the dock at the bottom of the screen, click the Terminal icon to launch a new Terminal window.
    
    In the next steps, we will be using the apt command to review and manage updates on this Linux server. The apt command is part of the Advanced Packaging Tool, which is used for installing and upgrading new software packages on Linux.
    
11. At the command prompt, type sudo apt update and press Enter to update the available package repositories.
    
    Take note of how many packages "can be upgraded".
    
12. At the command prompt, type the following command and press Enter to display all the upgradeable installed packages alphabetically.
    sudo apt list --upgradable | more
    Press Enter a few times to scroll through the output, then press Ctrl-Z to return to the command prompt.
    
13. At the command prompt, type sudo apt -s upgrade and press Enter to run a simulated upgrade.
    

    

    You can use this technique to see if errors will be thrown during the upgrade process. Typically the output is redirected to a file where it can be examined ( sudo apt -s upgrade > simulated_upgrade.txt).
    
    Next, we will outline the commands used to install Linux updates. For the purposes of this exercise, we will not actually install any updates at this time.
    
    You would use the sudo apt upgrade command to upgrade the system fully. Typically administrators will update the package repositories and upgrade the system in one shot ( sudo apt update && sudo apt upgrade). If you only want to upgrade a single package, you can use sudo apt install --only-upgrade package1 package2, etc.
    
    As with Windows, it is possible to exclude a package from being upgraded.
    
14. At the command prompt, type sudo apt-mark hold ufw and press Enter to prevent apt from upgrading the ufw package.
    
15. At the command prompt, type sudo apt-mark showhold and press Enter to see the packages on hold.
    

    

16. At the command prompt, type sudo apt-mark unhold ufw to allow the ufw package to be upgraded.
    
    Use sudo apt-mark showhold to validate that ufw is no longer on hold and thus upgradable.
    

    

    Next, we will look at updating a Docker image.
    
17. At the command prompt, type sudo docker ps and press Enter to list any running Docker images.
    
    You will see that a mysql server named mysql is running.
    

    

18. At the command prompt, type sudo docker inspect mysql | grep MYSQL_VERSION and press Enter to validate the version of mysql running.
    
19. At the command prompt, type sudo docker stop mysql and press Enter to shut down the docker mysql image.
    
20. At the command prompt, type sudo docker rm mysql and press Enter to remove the out-of-date mysql container.
    
21. At the command prompt, type sudo docker pull mysql and press Enter to download the latest version of mysql for Docker.
    

    

    Note: If you don’t specify a version, Docker assumes you want the most up-to-date version.
    
22. At the command prompt, type sudo docker images and press Enter to list all the Docker images.
    
23. At the command prompt, type sudo docker rmi mysql: X.X.XX to remove the out-of-date mysql image, replacing X.X.XX with the actual version number.
    
    Execute sudo docker images to confirm.
    
24. At the command prompt, execute the following command to start the updated mysql image.
    
    sudo docker run --name=mysql --restart=always -e MYSQL_ROOT_PASSWORD=cybrary -v /home/cybrary/mysql:/var/lib/mysql -d mysql
    
    Execute sudo docker ps to confirm.
    

    

25. At the command prompt, type sudo docker inspect | grep MYSQL_VERSION and press Enter to validate the version of the docker image.
    
    This concludes the guided exercise. Be sure to answer the questions on the Tasks tab, then proceed to the challenge exercise.